package com.guohui.common.util;

import java.beans.PropertyEditorSupport;
import java.util.regex.Pattern;

import org.springframework.util.StringUtils;
/**
 * XSS防攻击实现类
 * @author  yuanwei
 * @version V1.0
 * @date 2015年11月2日 下午7:31:34
 */
public class StringEscapeEditor extends PropertyEditorSupport {

	public StringEscapeEditor() {
		super();
	}

	@Override
	public void setAsText(String text) {

		if (StringUtils.isEmpty(text)) {

			setValue(null);

		} else {

			String value = stripXSS(text);
			setValue(value);

		}
	}

	@Override
	public String getAsText() {
		Object value = getValue();
		return value != null ? value.toString() : "";
	}

	private String stripXSS(String value) {
		if (value == null || value.equals("")) {
			return value;
		}
		 value = value.replaceAll("", "");
		 //是否为xss拦截  默认为false
		boolean xss = false;
		if (!value.contains("ignoreXSS")) {

		} else {
			value = value.replaceAll("ignoreXSS", "");
			xss = true;
		}
		 Pattern scriptPattern = Pattern.compile("<script>(.*?)</script>", Pattern.CASE_INSENSITIVE);
         value = scriptPattern.matcher(value).replaceAll("");
         scriptPattern = Pattern.compile("<iframe>(.*?)</iframe>", Pattern.CASE_INSENSITIVE);
         value = scriptPattern.matcher(value).replaceAll("");
         //xss放行所有a标签
         if (!xss) { 
        	 scriptPattern = Pattern.compile("<a>(.*?)</a>", Pattern.CASE_INSENSITIVE);
             value = scriptPattern.matcher(value).replaceAll("");
        	 scriptPattern = Pattern.compile("</a>", Pattern.CASE_INSENSITIVE);
        	 value = scriptPattern.matcher(value).replaceAll("");
        	 scriptPattern = Pattern.compile("<a(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
             value = scriptPattern.matcher(value).replaceAll("");
        	 scriptPattern = Pattern.compile("&lt;a&gt;(.*?)&lt;/a&gt;", Pattern.CASE_INSENSITIVE);
             value = scriptPattern.matcher(value).replaceAll("");
             scriptPattern = Pattern.compile("&lt;/a&gt;", Pattern.CASE_INSENSITIVE);
             value = scriptPattern.matcher(value).replaceAll("");
             scriptPattern = Pattern.compile("&lt;a(.*?)&gt;", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
             value = scriptPattern.matcher(value).replaceAll("");
        }
         scriptPattern = Pattern.compile("<link>(.*?)</link>", Pattern.CASE_INSENSITIVE);
         value = scriptPattern.matcher(value).replaceAll("");
         scriptPattern = Pattern.compile("<style>(.*?)</style>", Pattern.CASE_INSENSITIVE);
         value = scriptPattern.matcher(value).replaceAll("");
         scriptPattern = Pattern.compile("</script>", Pattern.CASE_INSENSITIVE);
         value = scriptPattern.matcher(value).replaceAll("");
         scriptPattern = Pattern.compile("</iframe>", Pattern.CASE_INSENSITIVE);
         value = scriptPattern.matcher(value).replaceAll("");
         scriptPattern = Pattern.compile("</link>", Pattern.CASE_INSENSITIVE);
         value = scriptPattern.matcher(value).replaceAll("");
         scriptPattern = Pattern.compile("</style>", Pattern.CASE_INSENSITIVE);
         value = scriptPattern.matcher(value).replaceAll("");
         scriptPattern = Pattern.compile("<script(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
         value = scriptPattern.matcher(value).replaceAll("");
         scriptPattern = Pattern.compile("<iframe(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
         value = scriptPattern.matcher(value).replaceAll("");
         scriptPattern = Pattern.compile("<link(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
         value = scriptPattern.matcher(value).replaceAll("");
         scriptPattern = Pattern.compile("<style(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
         value = scriptPattern.matcher(value).replaceAll("");
         scriptPattern = Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
         value = scriptPattern.matcher(value).replaceAll("");
         scriptPattern = Pattern.compile("e­xpression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
         value = scriptPattern.matcher(value).replaceAll("");
		 scriptPattern = Pattern.compile("&lt;script&gt;(.*?)&lt;/script&gt;", Pattern.CASE_INSENSITIVE);
        value = scriptPattern.matcher(value).replaceAll("");
         scriptPattern = Pattern.compile("&lt;iframe&gt;(.*?)&lt;/iframe&gt;", Pattern.CASE_INSENSITIVE);
        value = scriptPattern.matcher(value).replaceAll("");
        scriptPattern = Pattern.compile("&lt;link&gt;(.*?)&lt;/link&gt;", Pattern.CASE_INSENSITIVE);
        value = scriptPattern.matcher(value).replaceAll("");
        scriptPattern = Pattern.compile("&lt;style&gt;(.*?)&lt;/style&gt;", Pattern.CASE_INSENSITIVE);
        value = scriptPattern.matcher(value).replaceAll("");
        scriptPattern = Pattern.compile("&lt;/script&gt;", Pattern.CASE_INSENSITIVE);
        value = scriptPattern.matcher(value).replaceAll("");
        scriptPattern = Pattern.compile("&lt;/iframe&gt;", Pattern.CASE_INSENSITIVE);
        value = scriptPattern.matcher(value).replaceAll("");
        scriptPattern = Pattern.compile("&lt;/link&gt;", Pattern.CASE_INSENSITIVE);
        value = scriptPattern.matcher(value).replaceAll("");
        scriptPattern = Pattern.compile("&lt;/style&gt;", Pattern.CASE_INSENSITIVE);
        value = scriptPattern.matcher(value).replaceAll("");
        scriptPattern = Pattern.compile("&lt;script(.*?)&gt;", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
        value = scriptPattern.matcher(value).replaceAll("");
        scriptPattern = Pattern.compile("&lt;iframe(.*?)&gt;", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
        value = scriptPattern.matcher(value).replaceAll("");
        scriptPattern = Pattern.compile("&lt;link(.*?)&gt;", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
        value = scriptPattern.matcher(value).replaceAll("");
        scriptPattern = Pattern.compile("&lt;style(.*?)&gt;", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
        value = scriptPattern.matcher(value).replaceAll("");
        scriptPattern = Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
        value = scriptPattern.matcher(value).replaceAll("");
        scriptPattern = Pattern.compile("e­xpression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
        value = scriptPattern.matcher(value).replaceAll("");
		return value;

	}

}
